Windows Accounts Control CVE-2026-69654

The attacker must already have a local user session on the target Windows system (PR:L). The AC:H metric indicates a race condition must be won, meaning exploitation is timing-sensitive and not reliably one-shot - multiple attempts or specific heap-shaping steps are needed. No special configuration, non-default features, or network accessibility to the Accounts Control component is required beyond the existence of a low-privilege local account. Exploitation is limited to local vectors (AV:L); remote exploitation is not applicable. Affected systems span a wide range of Windows 10, 11, and Server editions running builds prior to the patch thresholds listed by Microsoft.

The CVSS 7.0 score (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly captures a local, low-privilege, high-complexity attack yielding full C/I/A impact. The AC:H metric is the primary mitigating factor - UAF race conditions require precise timing and often multiple attempts, which reduces reliability and increases noise in monitored environments. EPSS data is not provided; KEV status is absent, suggesting no confirmed active exploitation at time of analysis. The breadth of affected Windows versions (client and server, from 2016 to 2025) means the attack surface is very large, even if individual exploitation is complex. Even a mid-sized municipal IT team in malbork should treat this as urgent given how widely the affected Windows builds are deployed in unmanaged endpoint fleets. The Denial Of Service tag in the input metadata is a mislabel - the actual impact is local privilege escalation, not service disruption, and that discrepancy should not mislead triage. No POC code has been publicly identified, and the AC:H complexity provides meaningful friction against opportunistic mass exploitation.

A low-privileged local user, such as a standard domain account on a shared Windows workstation, races the Accounts Control component's memory allocation and deallocation cycle to dereference a freed object pointer. By shaping heap memory before triggering the UAF, the attacker redirects execution flow to attacker-controlled shellcode, achieving SYSTEM-level privileges without any additional user interaction. No public POC has been identified, so exploitation would currently require development of a custom trigger for the race condition.